LEGAL

Privacy Policy

Last updated: 7 November 2026

1. Who we are

This website is operated by City Max Technologies Limited ("City Max", "we", "us"), based in Nairobi, Kenya. We are the data controller for personal data collected through this website and through our business accounts on WhatsApp, Facebook and Instagram. It also explains how we handle data when we build and run WhatsApp and other Meta-based solutions for our business clients (see section 7). This policy explains what we collect, why, and the choices you have, in line with the Kenya Data Protection Act, 2019.

2. Information we collect

We only collect information you choose to give us, plus basic technical data needed to run the site:

  • Contact and demo request forms: your name, email address, phone number, company or business name, area of interest, preferred time and your message.
  • Community Voices (Insights page): the display name, title and text of posts and replies you publish. These are public and visible to anyone visiting the site, so please don't include personal details you don't want shared.
  • Direct contact: if you call, email or message us on WhatsApp, Facebook or Instagram, we receive your phone number, email address or profile name and the content of your message (see section 6).
  • Technical data: like most websites, our hosting provider automatically records standard server logs (such as IP address, browser type and pages requested) for security and reliability.

We do not use advertising trackers or sell personal data.

3. How we use your information

  • To respond to your enquiries, quotes and demo requests.
  • To provide, plan and deliver the supply, procurement and technology services you ask about.
  • To display and moderate community posts and replies.
  • To keep the website secure, prevent spam and fix problems.
  • To meet our legal, tax and regulatory obligations.

5. Who we share it with

We share data only with service providers that help us run the website, and only as needed:

  • Web3Forms: delivers contact and demo form submissions to our email inbox.
  • Supabase: stores Community Voices posts and replies.
  • Google Fonts: serves the fonts used on this site, which means your browser connects to Google's servers.
  • Meta Platforms (WhatsApp, Facebook, Instagram): carries the messages you send us on those services (see section 6).
  • Our website hosting provider, and email or business tools we use to manage enquiries.

We may also disclose information where required by law or to protect our rights. Some of these providers store data on servers outside Kenya; where that happens we rely on the safeguards permitted under the Data Protection Act.

6. WhatsApp, Facebook and Instagram

We use WhatsApp Business and Meta Business tools to talk with customers. When you message our WhatsApp number (+254 714 008 060) or our Facebook or Instagram pages, we receive:

  • your phone number and your WhatsApp, Facebook or Instagram profile name;
  • the messages, photos, documents and other files you send us;
  • basic message information, such as when a message was sent, delivered and read.

We use this information only to:

  • answer your questions and send you the quotes, invoices or information you ask for;
  • send updates about your order, delivery, project or support request;
  • keep a record of our conversation so we can serve you better.

We do not sell this information or use it for unrelated purposes, and we do not send you promotional messages unless you have agreed to receive them. You can stop messages at any time by replying "STOP" or telling us in the chat.

These messages pass through Meta's systems, so Meta's own policies also apply: WhatsApp Privacy Policy and Meta Privacy Policy.

7. WhatsApp and Meta solutions we provide to clients

As a technology provider, we set up and manage WhatsApp Business Platform and other Meta-based solutions (such as customer messaging, notifications and chat automation) for other businesses ("clients"). When we do this, the client controls its customers' data, and we process that data only on the client's behalf, following its instructions.

To provide these services, we may access or process:

  • the client's business account details, such as business name, WhatsApp Business Account and phone number IDs, message templates and the access permissions the client grants us through Meta;
  • data about the client's customers that flows through the service, such as phone numbers, profile names, message content, media and delivery or read status.

We commit that we:

  • use this data only to provide, maintain, secure and support the service the client asked for;
  • do not sell it, do not use it for our own marketing or advertising, and do not combine it with other data for unrelated purposes;
  • handle data received from Meta in line with Meta's Platform Terms and Developer Policies, and the WhatsApp Business policies;
  • store access tokens and data securely, limit access to staff who need it, and share it only with Meta and the infrastructure providers needed to run the service;
  • delete or return the data when the service ends, when the client asks, or when the client removes our access in its Meta Business settings, unless the law requires us to keep it.

If you are a customer of one of our clients, your data is governed mainly by that business's privacy policy. Please contact the business first. We will help it respond to your request, and you can also contact us directly (see How to delete your data).

8. Cookies and browser storage

We do not use advertising or analytics cookies. The Community Voices feature saves a few small items in your browser's local storage: the display name you last used, which posts you have upvoted, and when you last posted (to limit spam). This stays on your device and you can clear it at any time through your browser settings.

9. How long we keep it

We keep enquiry and client information only as long as needed to respond to you, provide our services and meet legal or accounting requirements, then delete or anonymise it. Community posts stay published until they are removed by us or at your request.

10. Security

We use reasonable technical and organisational measures to protect your data, including encrypted (HTTPS) connections and access controls on our systems. No method of transmission over the internet is completely secure, but we work to protect your information and will act promptly on any breach as the law requires.

11. Your rights

Under the Data Protection Act, 2019 you have the right to:

  • be informed of how your data is used;
  • access the personal data we hold about you;
  • ask us to correct inaccurate or misleading data;
  • ask us to delete data that is no longer needed or was processed unlawfully;
  • object to processing, and withdraw consent at any time;
  • receive your data in a portable format, where applicable.

To use any of these rights, including removing a community post, contact us using the details below. If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

12. How to delete your data

You can ask us to delete the personal data we hold about you at any time, including your WhatsApp, Facebook or Instagram conversations with us, your form submissions and your community posts. To do so:

  • email info@citymaxtechnologies.com with the subject "Data deletion request"; or
  • send us a WhatsApp message saying you want your data deleted.

Business clients can also remove our access at any time in Meta Business settings, and ask us to delete all data we hold for them.

Tell us the phone number, email address or name you used with us so we can find your records. We will confirm your request, delete or anonymise your data promptly and within the time required by law, and let you know once it's done. We may keep limited records where the law requires it (for example, tax records of completed sales). Messages stored in your own WhatsApp, Facebook or Instagram app stay under your control, and you can delete them there.

13. Children's privacy

This website is intended for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has shared personal data with us, please contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the "Last updated" date at the top.

16. Contact us

For any privacy questions or requests, contact:

Or use our contact page.